CVE-2026-109873
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment.